I don't think that splitting is usually necessary. If the company can prove that someone already reported it and there are not too long delays to fix the vulner

I don't think that splitting is usually necessary. If the company can prove that someone already reported it and there are not too long delays to fix the vulnerability, I would think that people would accept that this time they were not the first and they will try next time knowing that no one tries to screw them.